Synchronized network and process performance overview

ABSTRACT

A visualization system analyzes the data from a first capture system that captures communication events to and from a processing node, and a second capture system that captures processing events at the processing node, synchronizes the data to a common time base, and presents an integrated display of these communication and processing events. Timing diagrams are preferably used to display the processing events, and data-exchange charts are preferably used to display the communication events.

This application is a continuation in part of U.S. patent applicationSer. No. 11/505,176, filed 16 Aug. 2006, the contents of which isincorporated by reference herein, and claims the benefit of U.S.Provisional Patent Applications 60/709,762 filed 19 Aug. 2005, and60/750,665, filed 15 Dec. 2005.

BACKGROUND AND SUMMARY OF THE INVENTION

This invention relates to the field of computer applications, and inparticular to distributed applications that include communications amongprocessors on a network.

With advances in networking technology, distributed applicationscontinue to grow in popularity, and in complexity. In a typicaldistributed application, a client device may initiate the application,and the application may execute a request for data services at a remoteserver, and this remote server may in turn request data or otherprocessing from other remote servers. The executed processes at theservers may be specific components of the application residing at theservers, or they may be components provided by the servers and accessedby the application.

Users of an application are generally sensitive to performance andreliability issues associated with the application, and in a competitivemarket, will generally avoid slow or unreliable applications.Application developers are also sensitive to these issues, to assurethat their developed product remains competitive. In like manner,service providers are also sensitive to these issues, to assure thattheir provided service is not the cause of performance and reliabilityproblems that may affect their customers.

Tools are available for assessing network traffic performance, as aretools for assessing processing performance. The ACE system from OPNETTechnologies, Inc., of Bethesda, MD, for example, captures datatransmissions associated with an application across a network, andpresents the information as a data exchange chart, or as a Gantt chart,that illustrates the time spent communicating the application messagesbetween nodes on the network, as well as the time spent at each node.The OPENVIEW GLANCEPLUS system from Hewlett-Packett, on the other hand,captures processing system performance, including such parameters as CPUprocessing time, disk transfer rates, cache page faults, and so on.

As applications and networks increase in complexity, the distinctionbetween the traditionally separate tasks of network analysis andprocessing analysis is becoming less clear. As processing performancebecomes more and more dependent upon the amount and type of trafficarriving at a processing server, or the capacity of the network toaccept traffic from the server, the processing system manager needs toaddress how network activity affects the system's performance. And, asnetwork performance becomes more and more dependent upon the amount andtype of delays occurring at the processing server, or the capacity ofthe server to accept traffic from the network, the network systemmanager needs to address how the processing system's performance affectsthe network's performance.

It would be advantageous to provide an integrated view of networktraffic and processor system performance. By providing a synchronizeddisplay of traffic events and process events at one or more nodes of anetwork, the analysis of network and/or process performance can beperformed in the context of an interrelated and interdependent set oftraffic and process events.

This advantage and others are achieved by a method and system thatinclude a first capture system that captures communication events, and asecond capture system that captures processing events related to theapplication. A visualization system analyzes the data captured by eachof the capture systems, synchronizes the data to a common time base, andpresents an integrated display of these communication and processingevents.

BRIEF DESCRIPTION OF THE DRAWINGS

The invention is explained in further detail, and by way of example,with reference to the accompanying drawings wherein:

FIG. 1 illustrates an example network with traffic and processmonitoring components coupled to an integrated analysis system inaccordance with this invention.

FIGS. 2A and 2B illustrate example performance displays for process andtraffic events.

FIGS. 3A and 3B illustrate example user interface screens forcontrolling the integrated display of process and traffic events inaccordance with this invention.

Throughout the drawings, the same reference numerals indicate similar orcorresponding features or functions. The drawings are included forillustrative purposes and are not intended to limit the scope of theinvention.

DETAILED DESCRIPTION

In the following description, for purposes of explanation rather thanlimitation, specific details are set forth such as the particulararchitecture, interfaces, techniques, etc., in order to provide athorough understanding of the concepts of the invention. However, itwill be apparent to those skilled in the art that the present inventionmay be practiced in other embodiments, which depart from these specificdetails. In like manner, the text of this description is directed to theexample embodiments as illustrated in the Figures, and is not intendedto limit the claimed invention beyond the limits expressly included inthe claims. For purposes of simplicity and clarity, detaileddescriptions of well-known devices, circuits, and methods are omitted soas not to obscure the description of the present invention withunnecessary detail.

The invention is presented in the context of assessing network andprocess performance at a server that is accessed by a client andperforms tasks on behalf of the client. In the context of thisinvention, a network event is defined as a communication of a messagefrom a source node to a destination node, and network performance isdefined as a metric related to communications between pairs of sourceand destination nodes. The measure of effectiveness includes, forexample, the volume of traffic communicated between the pair of nodesduring a given period of time, the delay associated with thecommunication of messages between the pair, and so on. A processingevent, on the other hand, is any event at the processing system thatsends or receives the messages, independent of the particular pair ofnodes associated with each message. Process performance is defined as ametric associated with the processing events, independent of theparticular application that sends or receives the messages, andincludes, for example, the percentage of time that the processing CPU isbeing used, the amount of data transferred to and from storage, theefficiency of cache processing, and so on. One of ordinary skill in theart will recognize that the principles of this invention are applicableto the analysis of performance at any device or system that processesand communicates data over time.

FIG. 1 illustrates an example network comprising a client 110, server120, and database 130. This simple network is used as a paradigm for atypical configuration wherein a client requests information from aserver, the server processes the request, accesses one or more databasesto fulfill the request, then sends the requested information to theclient. In a typical embodiment, the server 120 will also be servicingother clients 111, 112, accessing other databases 131, 132, otherservers, and so on.

In accordance with this invention, an analysis system 150 is configuredto receive information from a process monitor 122 and traffic monitor124 that are coupled to, or integral to, the server 120. These monitors122, 124 are configured to capture performance metrics associated withthe processing of data at the server and the communication of data toand from the server, respectively.

In the above referenced parent application to this application,“CAPTURE, ANALYSIS, AND VISUALIZATION OF CONCURRENT SYSTEM AND NETWORKBEHAVIOR OF AN APPLICATION”, Ser. No. 11/505,176, filed 16 Aug. 2006 forBaron et al., techniques are disclosed for tracing traffic and processevents related to a target application by instrumenting the applicationprocesses on the processing server to effect the capture of relevantprocess events. This invention is premised on the observation thatnetwork and process performance often needs to be analyzed and assessedindependent of a particular application; or, if an application is beingassessed, the analysis often needs to also address how the applicationis being affected by the overall network and process performance in thecontext of multiple concurrent applications.

The process monitor 122 preferably includes one or more conventionalprocess monitoring tools, such as the aforementioned OPENVIEW GLANCEPLUStool from HP, or others, such as PANORAMA from OPNET and the variousPERFMON (Performance Monitor) embodiments available from Microsoft, HP,Sun Systems, and so on. The process monitor captures information that isspecific to the server 120, such as CPU and disk utilizationpercentages, average disk queue length, cache hit ratio, numbers ofblocked and unblocked users, and a variety of measures per unit time,such as numbers of system calls or interrupts per second, logical andphysical disk reads and writes per second, page faults and cache faultsper second, and so on. The process monitor 122 also captures informationrelated to the network interface to the server, such as bytes or packetssent or received per second, output queue length, and so on.

The traffic monitor 124, on the other hand, captures informationspecific to the messages communicated over the network, including anidentification of source and destination nodes for each message, thesize of each message, the message data, and so on. As noted above, toolssuch as OPNET's ACE system are particularly well suited for controllingand managing the capture of network performance metrics.

In a preferred embodiment of this invention, the analysis system 150 isconfigured to facilitate control of each of the process monitor 122 andtraffic monitor 124. This control may be automated or manual, or acombination of both. In the automated mode, events at one of themonitors 122, 124 trigger the start of data collection at the othermonitor. For example, detection of a message at the traffic monitor 124to or from a particular source or destination node may trigger the startof data collection at the process monitor 122; or, a significant changeto one of the monitored processing parameters at the process monitor 122may trigger the start of data collection at the traffic monitor 124.Such triggering is particularly advantageous when Quality of Service(QoS) guarantees are in place in the network. Any violation ofpredetermined thresholds triggers the start of data collection at bothmonitors 122, 124 so that appropriate analysis can be performed.Alternatively, or additionally, the analysis system may initiate thedata collection on a periodic basis, or based on events at other nodesin the network, and so on. In the manual mode, the user may be providedthe option of viewing the activity at one of the monitors, andinitiating data collection at the other on demand. Optionally, themonitors 122 and 124 may be configured to continuously monitor theprocess and traffic events, and the analysis system is configured tocontrol storing of the data for subsequent viewing and analysis,automatically or manually.

FIGS. 2A and 2B illustrate example graphic displays of process andnetwork performance, respectively. FIG. 2A illustrates the plots of datafrom the process monitor 122, and, in this example, are identified asplots of CPU utilization, disk transfers, and disk queue as a functionof processor time PT. Typically, process monitoring tools use the hostserver's CPU clock as the time base.

FIG. 2B illustrates a plot of data exchanges between the client andserver, and between the server and database as a function of networktime NT. Each message is identified as an arrow from one “tier” to theother, the arrow-head identifying the destination tier. The thickness ofthe arrows in this example serve to illustrate the size/volume of eachmessage; other techniques may also or alternatively be used todistinguish message size, such as the use of color to distinguishdifferent ranges of size. If the time-scale is large, alternativeformats, such as a histogram display, may be used when individualmessage arrows become infeasible to display, or become indistinguishabledue to density; color may also be used in such histograms, to indicatethe proportion of messages of different size ranges.

The inclination of the arrows in FIG. 2B indicates the delay between thetransmission from the source tier and the reception at the destinationtier. The transmission time is assigned at the source tier, and thereception time is assigned at the destination tier. Generally, there maybe differences among the time bases used at each tier, and the networktime NT is typically a normalized time among these bases, which may ormay not correspond to the aforementioned processor time PT used by theprocess monitor 122. Copending U.S. patent application “SYNCHRONIZINGPACKET TRACES”, Ser. No. 10/914,603, filed 6 Aug. 2004 for Malloy etal., teaches techniques for determining a common network time base basedon constraint propagation (a message cannot be received before it istransmitted, etc.), and is incorporated by reference herein. Inaccordance with an aspect of this invention, the process graphs of FIG.2A and the data exchange chart of FIG. 2B are displayed concurrently sothat the correspondence and interdependencies among network events andprocess events can be visualized.

If, as is typical, the network time NT does not correspond to theprocessor time PT, some correspondence between the clocks must beestablished before the data can be properly displayed. In astraightforward embodiment, the user is provided the option of manuallyinputting an appropriate offset that establishes when the process datastarts relative to the traffic data. Alternatively, the user may input aknown difference between the network time NT and the process time PT.Each of these options is preferably provided via a graphical userinterface. In an interactive embodiment, the user is provided the optionof ‘grabbing’ one or more of the graphs or charts of FIGS. 2A, 2B and‘sliding’ it until the data is properly synchronized, for example, byselecting one of the graphs with a mouse pointer, holding the mousebutton down, dragging the graph along a horizontal axis to a desiredstopping point, and releasing the mouse button.

Typically, each of the manual synchronization options described aboverequires that the user have a reasonable understanding of the collecteddata and/or the process and network monitors 122, 124. In more automatedembodiments, the network and process data can be synchronized to acommon time base with little or no user interaction.

Any of a variety of techniques may be used to facilitate the automateddetermination of a common time base. For example, prior to capturingdata, the invention could instruct the process monitor 122 and networkmonitor 124 to synchronize their clocks. This can be accomplished bysynchronizing one with the other, or synchronizing each with a globaltime base, such as those regulated by the Global Positioning System(GPS) or the Network Time Protocol (NTP), or to an arbitrary time base.If the clocks cannot be synchronized prior to capturing data, each ofthe process monitor 122 and network monitor 124 could supply, with theircorresponding capture data, an offset that identifies the differencebetween their clocks and that of a global clock. Alternatively, if bothmonitors 122, 124 provide an option to read its current time, the system150 need merely request the current time from each and adjust thereported times accordingly. As noted above, however, the network time NTused for data exchange charts is often a normalized time based on apost-process analysis of the reported times, and the time at the monitor124 would not necessarily correspond to this determined network time NT.If the process that determines the normalized network time NT can beconfigured to set the time base to a select one of the tiers and adjustthe other tier time bases accordingly, and if it is known that thetraffic monitor 124 at the server 120 uses the server's CPU time, thesystem 150 need only direct the process to use the time base of thetraffic monitor 124 as the normalized network time NT.

If the above manual or automated determinations of a common time basebetween the process time PT and network time NT cannot be used, othersynchronizing techniques, such as pattern-matching may be used. That is,patterns in the graphs of the process events of FIG. 2A can be comparedto patterns in the data-exchange graph of FIG. 2B to determine a likelyalignment of these displays to a common time base. Consider, forexample, the network events to the right of NT1 in FIG. 2B and the diskqueue size to the right of PT1 in FIG. 2A. The pattern to the right ofNT1 suggests an initial exchange between the client and server, and acorresponding subsequent exchange between the server and the database,with a substantial data transfer from the database to the server andthen from the server to the client. This message pattern after time NT1in FIG. 2B could account for the disc queue size increase after PT1 inFIG. 2A, implying that the time base of FIG. 2A should be moved to theright (advanced) to better align the events of FIG. 2A with the eventsof FIG. 2B. Other pattern comparisons, such as events at PT2 and NT2,and events at PT3 and NT3, would also suggest the advancement of theprocess time base to better align these patterns.

In a preferred embodiment, a combination of user interaction andautomated synchronization is used. For example, the time baseadjustments can be based on prior time shift determinations. That is, ifat some prior time it had been determined that the process time PT andnetwork time NT at a particular server differed by a given amount, thisamount may be used as an initial offset for providing a common timebase, subject to subsequent user adjustment. These and other techniquesfor determining or approximating a correspondence between the processand network time bases will be evident to one of skill in the art inview of this disclosure.

FIGS. 3A and 3B illustrate example user interface screens for ananalysis system of this invention.

In a typical embodiment of a processor monitor, such as HP GLANCEPLUS,all of the processing-related data is maintained in a single file for agiven processing system, or in a single database. The dialog box of FIG.3A allows a user to select which time-based statistics/metrics to graph.In a preferred embodiment, time-based metrics related to the network arealso provided by the traffic monitor, or the analysis system, includingsuch metrics as application throughput, network throughput,retransmissions, etc. The user interacts with these lists of availabletime-based processor statistics/metrics 331, 332, etc. and networkperformance statistics/metrics 321, 322 to select which metrics toinclude or exclude 341 in the display region 360 of FIG. 3B, discussedbelow.

In a preferred embodiment, the individual time-based metrics can beoverlaid upon each other, using different colors for different metrics.The user is provided the option 342 of having the system overlay all ofthe selected metrics on a single graph, or having the system overlaysets of similar metrics on each of a plurality of graphs. That is, forexample, all of the metrics related to the CPU may be placed on onegraph, all of the metrics related to disk-transfers can be placed onanother, and so on. Preferably, default similarity sets are provided,and the user is provided the option of defining other sets, selectingthe colors to be used within the sets, and so on. Alternatively, eachselected metric could be place on a separate graph.

FIG. 3B illustrates the display 350 for analyzing network traffic inconjunction with the selected process performance metrics. At region360, the performance metrics selected in the dialog box 310 of FIG. 3Aare displayed, and in region 370, the data exchange chart is displayedbetween select tiers 381, 382, 383. The performance metrics and dataexchange chart are displayed using the aforementioned common time base,offsetting either the process or traffic time scale to match the other.Furthermore, horizontal scrolling or zooming within either region 360 or370 will affect the other region, so as to constantly maintain thecommon time base for both regions.

The process performance metrics are preferably displayed as timingdiagrams, while the network traffic data is preferably displayed usingdata exchange charts; as noted above, traffic performance metrics mayalso be displayed as timing diagrams in display region 360, with theselected process performance metrics. In the example of FIG. 3B, the CPUutilization (“GBL_CPU_TOTAL_UTIL”) 331 and disk transfer volume(“GBL_DISK_PHYS_BYTE”) 332 metrics from the process file are displayed,and a scroll bar 361 is provided to scroll through the other availableprocess metrics. In like manner, the data exchange sequence 391 between“Server” 381 and “Tier 2” 382 and the data exchange sequence 392 between“Server” 381 and “Tier 3” 383 are shown in area 370, using a commontier-line for the “Server” tier 381. If additional tier-pairs arepresent in the captured traffic and selected for inclusion in a dataexchange chart, a similar scroll bar 371 is provided to select whichpairs to display. In the example display 370, a histogram format is usedfor illustrating the data exchange 391, 392, using different colors fordifferent sized packets, the key for the color being given at 390.

Other interface screens are also provided, including an interface tocontrol the process and traffic monitoring tools, an interface tocontrol the timing offset between the process and traffic time bases,and so on.

The foregoing merely illustrates the principles of the invention. Itwill thus be appreciated that those skilled in the art will be able todevise various arrangements which, although not explicitly described orshown herein, embody the principles of the invention and are thus withinits spirit and scope. For example, although the process monitor 122 andtraffic monitor 124 are conventionally different devices or modules, oneof skill in the art will recognize in view of the principles presentedherein, that a single monitor that incorporates the functions ofmonitors 122 and 124 can be provided. In like manner, an integratedanalysis system could be provided that includes the analysis component150 and one or both of the monitors 122, 124. These and other systemconfiguration and optimization features will be evident to one ofordinary skill in the art in view of this disclosure, and are includedwithin the scope of the following claims.

In interpreting these claims, it should be understood that:

-   -   a) the word “comprising” does not exclude the presence of other        elements or acts than those listed in a given claim;    -   b) the word “a” or “an” preceding an element does not exclude        the presence of a plurality of such elements;    -   c) any reference signs in the claims do not limit their scope;    -   d) several “means” may be represented by the same item or        hardware or software implemented structure or function;    -   e) each of the disclosed elements may be comprised of hardware        portions (e.g., including discrete and integrated electronic        circuitry), software portions (e.g., computer programming), and        any combination thereof;    -   f) hardware portions may be comprised of one or both of analog        and digital portions;    -   g) any of the disclosed devices or portions thereof may be        combined together or separated into further portions unless        specifically stated otherwise;    -   h) no specific sequence of acts is intended to be required        unless specifically indicated; and    -   i) the term “plurality of” an element includes two or more of        the claimed element, and does not imply any particular range of        number of elements; that is, a plurality of elements can be as        few as two elements, and can include an immeasurable number of        elements.

1. A system comprising: a network monitoring tool that is configured tocapture traffic data corresponding to traffic events to and from aprocessing node, a process monitoring tool that is configured to captureprocess data corresponding to processing events at the processing node,an analysis system that is configured to receive the traffic data andprocess data and to display the traffic data and process data using acommon time base.
 2. The system of claim 1, including the processingnode.
 3. The system of claim 1, wherein the analysis systemautomatically determines the common time base.
 4. The system of claim 3,wherein the analysis system determines the common time base based on acorrelation between the traffic events and process events.
 5. The systemof claim 4, wherein the analysis system determines the correlation basedon pattern recognition.
 6. The system of claim 1, wherein the analysissystem includes a user interface that facilitates a user's control ofthe analysis system to determine the common time base.
 7. The system ofclaim 1, wherein the analysis system displays the traffic data using adata exchange chart.
 8. The system of claim 7, wherein the analysissystem displays a volume metric associated with the traffic data usingat least one of a color parameter and a size parameter.
 9. The system ofclaim 8, wherein the analysis system displays the traffic data using ahistogram format.
 10. The system of claim 7, wherein the analysis systemdisplays the process data using a timing diagram.
 11. The system ofclaim 10, wherein the data exchange chart and the timing diagram aresynchronized relative to the common time base, such that a change of thedisplay of the common time base in the data exchange chart effects acorresponding change of the display of the timing diagram, and a changeof the display of the common time base in the timing diagram effects acorresponding change of the display of the data exchange chart.
 12. Thesystem of claim 1, wherein the analysis system displays the process datausing a timing diagram.
 13. The system of claim 1, wherein the displayof the traffic data and the display of the process data are synchronizedrelative to the common time base, such that a change of the display ofthe traffic data relative to the common time base effects acorresponding change of the display of the process data relative to thecommon time base, and a change of the display of the process datarelative to the common time base effects a corresponding change of thedisplay of the traffic data relative to the common time base.
 14. Thesystem of claim 1, wherein the process data corresponds to a pluralityof process metrics, and the analysis system is configured to facilitatea user's selection of one or more process-metrics for displaying eachselected process-metric.
 15. The system of claim 14, wherein theanalysis system is configured to facilitate display of two or moreprocess-metrics of the selected process-metrics in an overlay mode. 16.The system of claim 15, wherein the analysis system is configured to usedifferent colors to display each of the two or more process-metrics inthe overlay mode.
 17. The system of claim 1, wherein the analysis systemis configured to control the network monitoring tool.
 18. The system ofclaim 17, wherein the analysis system is configured to control thenetwork monitoring tool based on one or more of the processing events.19. The system of claim 17, wherein the analysis system is configured tocontrol the process monitoring tool.
 20. The system of claim 1, whereinthe analysis system is configured to control the process monitoringtool.
 21. The system of claim 20, wherein the analysis system isconfigured to control the process monitoring tool based on one or moreof the traffic events.
 22. An analysis system comprising: a receivercomponent that is configured to: receive traffic data corresponding totraffic events from a network monitoring tool and receive process datacorresponding to processing events from a process monitoring tool, ananalysis component that is configured to facilitate determination of acommon time base between the traffic events and processing events, and adisplay component that is configured to display the traffic data andprocess data using the common time base.
 23. The system of claim 22,wherein the analysis component determines the common time base based ona correlation between the traffic events and process events.
 24. Thesystem of claim 23, wherein the analysis component determines thecorrelation based on pattern recognition.
 25. The system of claim 22,wherein the analysis component includes a user interface thatfacilitates a user's control of the analysis system to determine thecommon time base.
 26. The system of claim 22, wherein the displaycomponent displays the traffic data using a data exchange chart.
 27. Thesystem of claim 26, wherein the display component displays a volumemetric associated with the traffic data using at least one of a colorparameter and a size parameter.
 28. The system of claim 27, wherein thedisplay component displays the traffic data using a histogram format.29. The system of claim 26, wherein the analysis system displays theprocess data using a timing diagram.
 30. The system of claim 29, whereinthe display component is configured to synchronously display the dataexchange chart and the timing diagram, such that a change in the dataexchange chart relative to the common time base effects a correspondingchange of the display of the timing diagram, and a change in the timingdiagram relative to the common time base effects a corresponding changeof the display of the data exchange chart.
 31. The system of claim 22,wherein the display component displays the process data using a timingdiagram.
 32. The system of claim 22, wherein the display of the trafficdata and the display of the process data are synchronized relative tothe common time base, such that a change of the display of the trafficdata relative to the common time base effects a corresponding change ofthe display of the process data relative to the common time base, and achange of the display of the process data relative to the common timebase effects a corresponding change of the display of the traffic datarelative to the common time base.
 33. The system of claim 22, whereinthe process data corresponds to a plurality of process metrics, and theanalysis component is configured to facilitate a user's selection of oneor more process-metrics for displaying each selected process-metric. 34.The system of claim 33, wherein the analysis component is configured tofacilitate display of two or more process-metrics of the selectedprocess-metrics in an overlay mode.
 35. The system of claim 34, whereinthe analysis component is configured to use different colors to displayeach of the two or more process-metrics in the overlay mode.
 36. Thesystem of claim 22, wherein the analysis component is configured tocontrol the network monitoring tool.
 37. The system of claim 36, whereinthe analysis component is configured to control the network monitoringtool based on one or more of the processing events.
 38. The system ofclaim 36, wherein the analysis component is configured to control theprocess monitoring tool.
 39. The system of claim 22, wherein theanalysis component is configured to control the process monitoring tool.40. The system of claim 39, wherein the analysis system is configured tocontrol the process monitoring tool based on one or more of the trafficevents.
 41. A method comprising: capturing traffic data from a networkmonitoring tool corresponding to traffic events to and from a processingnode, capturing process data from a process monitoring toolcorresponding to processing events at the processing node, determining acommon time base between the traffic data and process data, anddisplaying the traffic data and process data using the common time base.42. The method of claim 41, wherein determining the common time baseincludes determining a correlation between the traffic events andprocess events.
 43. The method of claim 42, wherein determining thecorrelation includes pattern recognition.
 44. The method of claim 41,wherein determining the common time base includes receiving a user inputthat facilitates determining the common time base.
 45. The method ofclaim 41, wherein displaying the traffic data includes displaying a dataexchange chart.
 46. The method of claim 45, wherein displaying the dataexchange chart includes displaying a volume metric associated with thetraffic data using at least one of a color parameter and a sizeparameter.
 47. The method of claim 46, wherein displaying the trafficdata includes displaying the traffic data using a histogram format. 48.The method of claim 45, wherein displaying the process data includesdisplaying a timing diagram.
 49. The method of claim 48, including:changing the data exchange chart relative to the common time base basedon a corresponding change of the display of the timing diagram, andchanging the timing diagram relative to the common time base based on acorresponding change of the display of the data exchange chart.
 50. Themethod of claim 41, wherein displaying the process data includesdisplaying a timing diagram.
 51. The method of claim 41, including:changing the data exchange chart relative to the common time base basedon a corresponding change of the display of the timing diagram, andchanging the timing diagram relative to the common time base based on acorresponding change of the display of the data exchange chart.
 52. Themethod of claim 41, wherein the process data corresponds to a pluralityof process metrics, and the method includes detecting a user's selectionof one or more process-metrics for displaying each selectedprocess-metric.
 53. The method of claim 52, wherein displaying theselected process-metrics includes displaying two or more process-metricsof the selected process-metrics in an overlay mode.
 54. The method ofclaim 53, wherein displaying the selected process-metrics includesdisplaying two or more process-metrics of the selected process-metricsusing different colors in the overlay mode.
 55. The method of claim 41,including controlling the network monitoring tool.
 56. The method ofclaim 41, including controlling the network monitoring tool based on oneor more of the processing events.
 57. The method of claim 56, includingcontrolling the process monitoring tool.
 58. The method of claim 41,including controlling the process monitoring tool.
 59. The method ofclaim 41, including controlling the process monitoring tool based on oneor more of the traffic events.